Privacy documentation for your healthcare clients
Health clients: special category data, NIS2 and medical AI
Health data is a special category under Article 9 GDPR, health care is an Annex I sector under NIS2, and AI in a medical device is high risk under the AI Act. The interview asks about each; the documents follow your confirmed answers.
Special category data
The interview records whether the client handles health data, and the privacy policy, records of processing and DPA are drafted with the Article 9 basis you confirm.
NIS2 for health care
Health care providers, reference laboratories and medical device and pharmaceutical manufacturers are listed in Annex I. The scope check suggests the class from sector and size.
AI in medical devices
An AI safety component of a product covered by Annex I legislation, such as a medical device, is high risk. The AI inventory suggests the category for you to confirm.
The pack for a client like this
With GDPR, NIS2, EU AI Act enabled. NIS2 and the AI Act are add-on modules, enabled per client once you confirm they apply.
- Privacy policy
- Cookie policy
- Data processing agreement
- Subprocessor list
- Records of processing activities
- Retention schedule
- Data subject request procedure
- Access control policy
- Incident response policy
- Business continuity and disaster recovery policy
- Secure development policy
- Vendor management policy
- Acceptable use policy
- Security overview
- AI system inventory
- AI technical documentation
- AI risk assessment
- Fundamental rights impact assessment
- AI human oversight procedure
- AI literacy policy
- AI contract clauses
- AI logging policy
- NIS2 cybersecurity risk-management policy
- NIS2 incident reporting procedure
- NIS2 supply chain security policy
- NIS2 business continuity and crisis management plan
- NIS2 management accountability record
- NIS2 asset and supplier register
Not covered
Said here rather than found out later.
- Medical device conformity assessment (MDR, IVDR)
- HIPAA
See what changed since your clients' policies were written
Enter up to ten client websites. Free, no sign-up, the first report in about a minute.